CVE-2021-32039— MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
Quick assessment
Affected
MongoDB Inc. MongoDB for VS Code
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDb For Vs Code是用于直接从 Vs Code 环境连接到 MongoDb 和 Atlas，导航数据库和集合，检查架构并使用 Playground 对查询和聚合进行原型设计。 MongoDb For Vs Code 存在安全漏洞，该漏洞源于具有适当文件访问权限的用户可以访问未加密的用户凭证并保存在MongoDB扩展的二进制文件VS Code，攻击者可利用该漏洞用来执行未经授权的操作。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-32039
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
Source: CVE Program / CVE List V5
Vulnerability Description
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDb For Vs Code 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDb For Vs Code是用于直接从 Vs Code 环境连接到 MongoDb 和 Atlas，导航数据库和集合，检查架构并使用 Playground 对查询和聚合进行原型设计。 MongoDb For Vs Code 存在安全漏洞，该漏洞源于具有适当文件访问权限的用户可以访问未加密的用户凭证并保存在MongoDB扩展的二进制文件VS Code，攻击者可利用该漏洞用来执行未经授权的操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc. | MongoDB for VS Code | MongoDB for VS Code ~ 0.7.0 | - |
|
II. Public POCs for CVE-2021-32039
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-32039
请登录查看更多情报信息。
Other References for CVE-2021-32039 (2)
-
https://jira.mongodb.org/browse/VSCODE-313 x_refsource_MISC
-
https://github.com/mongodb-js/vscode/releases/tag/v0.8.0 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: MongoDB Inc.
-
CVE-2026-6811
PHP Stack Exhaustion -
CVE-2026-8063
Post-auth null pointer dereference when aggregating against -
CVE-2026-6691
MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow -
CVE-2026-6231
bson_validate may skip validation when processing certain in -
CVE-2025-14847
Zlib compressed protocol header length confusion may allow m
Same weakness: CWE-522
-
CVE-2026-71494
Infracost: Terraform Cloud and registry token disclosure via -
CVE-2026-20359
Cisco Crosswork Security Hardening Release: August 2026 -
CVE-2026-8810
HDD Password leakage vulnerability -
CVE-2026-53456
Blueprint Studio terminal SSH private key written to disk -
CVE-2026-53454
Blueprint Studio stored Git credentials in plaintext Git cre
V. Comments for CVE-2021-32039
No comments yet